Vulnerability CVE-2008-3271


Published: 2008-10-13   Modified: 2012-02-12

Description:
Apache Tomcat 5.5.0 and 4.1.0 through 4.1.31 allows remote attackers to bypass an IP address restriction and obtain sensitive information via a request that is processed concurrently with another request but in a different thread, leading to an instance-variable overwrite associated with a "synchronization problem" and lack of thread safety, and related to RemoteFilterValve, RemoteAddrValve, and RemoteHostValve.

See advisories in our WLB2 database:
Topic
Author
Date
Low
Apache Tomcat information disclosure
Mark Thomas
14.10.2008

Type:

CWE-264

(Permissions, Privileges, and Access Controls)

Vendor: Apache
Product: Tomcat 
Version:
5.5.0
4.1.9
4.1.8
4.1.7
4.1.6
4.1.5
4.1.4
4.1.31
4.1.30
4.1.3
4.1.29
4.1.28
4.1.27
4.1.26
4.1.25
4.1.24
4.1.23
4.1.22
4.1.21
4.1.20
4.1.2
4.1.19
4.1.18
4.1.17
4.1.16
4.1.15
4.1.14
4.1.13
4.1.12
4.1.11
4.1.10
4.1.1
4.1.0

CVSS2 => (AV:N/AC:M/Au:N/C:P/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
4.3/10
2.9/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
None
None

 References:
http://jvn.jp/en/jp/JVN30732239/index.html
http://jvndb.jvn.jp/en/contents/2008/JVNDB-2008-000069.html
http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00012.html
http://securityreason.com/securityalert/4396
http://tomcat.apache.org/security-4.html
http://tomcat.apache.org/security-5.html
http://www.fujitsu.com/global/support/software/security/products-f/interstage-200806e.html
http://www.nec.co.jp/security-info/secinfo/nv09-006.html
http://www.securityfocus.com/archive/1/497220/100/0/threaded
http://www.securityfocus.com/bid/31698
http://www.securitytracker.com/id?1021039
http://www.vupen.com/english/advisories/2008/2793
http://www.vupen.com/english/advisories/2008/2800
http://www.vupen.com/english/advisories/2009/1818
https://exchange.xforce.ibmcloud.com/vulnerabilities/45791
https://issues.apache.org/bugzilla/show_bug.cgi?id=25835
https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3E

Related CVE
CVE-2019-12419
Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is...
CVE-2019-12410
While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data uninitialized when reading RLE null data from parquet. This affected the C++, Python, Ruby ...
CVE-2019-12408
It was discovered that the C++ implementation (which underlies the R, Python and Ruby implementations) of Apache Arrow 0.14.0 to 0.14.1 had a uninitialized memory bug when building arrays with null values in some cases. This can lead to uninitialized...
CVE-2019-12406
Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message. This leaves open the possibility of a denial of service type attack, where a malicious user crafts a message containing a very large nu...
CVE-2009-5004
qpid-cpp 1.0 crashes when a large message is sent and the Digest-MD5 mechanism with a security layer is in use .
CVE-2019-10084
In Apache Impala 2.7.0 to 3.2.0, an authenticated user with access to the IDs of active Impala queries or sessions can interact with those sessions or queries via a specially-constructed request and thereby potentially bypass authorization and audit ...
CVE-2018-11768
In Apache Hadoop 3.1.0 to 3.1.1, 3.0.0-alpha1 to 3.0.3, 2.9.0 to 2.9.1, and 2.0.0-alpha to 2.8.4, the user/group information can be corrupted across storing in fsimage and reading back from fsimage.
CVE-2019-0231
Handling of the close_notify SSL/TLS message does not lead to a connection closure, leading the server to retain the socket opened and to have the client potentially receive clear text messages afterward. Mitigation: 2.0.20 users should migrate to 2....

Copyright 2019, cxsecurity.com

 

Back to Top